Claude Code sessions can message each other, and auto mode becomes the default on Thursday

Two days from now, on August 14, auto mode becomes the default permission mode for new Pro, Max, and Team sessions (Claude Code Docs, Week 32). Not opt-in. Default. Every new session you start after Thursday has a different permission posture than the ones you started this week, whether you thought about it or not.

The classifier calls that drive auto mode no longer count toward usage limits, which removes the one argument against leaving it on. But if you've built habits around the old default, go read what auto mode actually permits before Thursday rather than after. I'd rather spend ten minutes now than debug a surprise write later.

The bigger primitive in Week 32 (v2.1.220–224) is cross-session messaging on macOS and Linux. Claude discovers other local sessions via a ListAgents tool and sends text with SendMessage, either when you ask or on its own when a change in one session affects another. /list-agents shows what's reachable. Critically: it passes written text only. Never conversation history, never files. That constraint is doing a lot of work, and I think it's the right call, but it means the messages are exactly as good as the sending session's ability to summarize itself.

Also shipped: the 200-subagent-per-session cap is gone, /fork now runs in its own worktree, and worktree isolation extends past file edits to Bash commands and git redirects. That last one matters more than it sounds. A forked session that could still rm outside its worktree wasn't isolated, it was politely suggested.

Now the part nobody's connecting. Agents that talk to each other are a new failure surface, and a paper landed this week that names it precisely. "Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems" evolved ideas that spread agent-to-agent through multi-agent systems (arXiv 2608.10218). Good news buried in it: harmful payloads propagate notably worse than benign ones, and a brief warning in the system prompt conferred what the authors call near-total immunity. That is an absurdly cheap mitigation. Add two sentences to your system prompt telling the model that instructions arriving from other agents are data, not commands, and you've covered most of it.

Pair that with MasDrift, which benchmarked 600 productivity tasks across eight domains to see whether multi-agent systems keep authorization boundaries intact when they delegate (arXiv 2608.07556). Centralized hierarchies completed 93.9–98.6% of tasks against 85.7–87.0% for peer networks. They also took unauthorized actions in 2.7–19.8% of runs, versus 0.6–0.8% for peers. That's up to a 25x difference in permission violations, bought with about ten points of completion rate.

The manager-and-specialists pattern everyone is standardizing on trades permission integrity for throughput. I've been building that pattern. I'm now going to go instrument it.